Embodiments disclosed herein may intercept, quarantine, and moderate communications internal to an uncontrolled system. An example of an uncontrolled system may be a web application associated with a social networking site. In accessing the social networking site, a user may type in a message. An instance of the uncontrolled system running on the user's device may prepare a request containing the message. Some embodiment disclosed herein may determine that the message is subject to moderation, intercept the request, and place the message in a queue. This determination may be based on the destination of the request as well the type of the message. Some embodiments may reconstruct the original request for resubmission. If the session is expired, some embodiments may log in for the user and resubmit the reconstructed request. Some embodiments may simply wait for the next time the user logs in to resubmit the reconstructed request.
|
8. A computer program product comprising at least one non-transitory computer readable medium storing instructions translatable by at least one processor to cause a service module to perform:
determining whether a request destined for an uncontrolled web application associated with a network site operating outside of a computing environment is to be intercepted, wherein the request is from a device associated with a user in the computing environment and wherein the request is generated by code downloaded from the uncontrolled web application to the device associated with the user in the computing environment, the code acting as an agent for the uncontrolled web application;
if the request is not to be intercepted, forwarding the request to a destination referenced in the request;
if the request is to be intercepted, placing the request in a moderation flow, wherein the moderation flow comprises:
determining whether the request is to be blocked from or approved for reaching the uncontrolled web application; and
blocking or approving the request, wherein approving the request comprises:
reconstructing the request for resubmission to the uncontrolled web application, wherein the resubmission comprises:
detecting that the user logs in to the uncontrolled web application or automatically providing user log in information to the uncontrolled web application; and
submitting the reconstructed request.
12. A system for intercepting internal communications of uncontrolled web applications associated with network sites external to a computing environment, comprising:
a proxy server communicatively connected to a plurality of devices in the computing environment and a plurality of server computers running the uncontrolled web applications associated with the network sites external to the computing environment, the proxy server being operable to determine whether a request from a device associated with a user in the computing environment is destined for an uncontrolled web application associated with a network site operating outside of the computing environment; and
a service module operable to:
receive the request from the proxy server if the request is destined for the uncontrolled web application, wherein the request is generated by code downloaded from the uncontrolled web application to the device associated with the user in the computing environment, the code acting as an agent for the uncontrolled web application;
determine whether the request destined for the uncontrolled web application is to be intercepted;
if the request is not to be intercepted, forwarding the request to a destination referenced in the request;
if the request is to be intercepted, placing the request in a moderation flow, wherein the moderation flow comprises:
determining whether the request is to be blocked from or approved for reaching the uncontrolled web application; and
blocking or approving the request, wherein approving the request comprises:
reconstructing the request for resubmission to the uncontrolled web application, wherein the resubmission comprises:
detecting that the user logs in to the uncontrolled web application or automatically providing user log in information to the uncontrolled web application; and
submitting the reconstructed request.
1. A method for intercepting internal communications of uncontrolled web applications associated with network sites external to a computing environment, comprising:
at a proxy server communicatively connected to a plurality of devices in the computing environment and a plurality of server computers running the uncontrolled web applications associated with the network sites external to the computing environment, determining whether a request from a device associated with a user in the computing environment is destined for an uncontrolled web application associated with a network site operating outside of the computing environment;
the proxy server forwarding the request to a service module if the request is destined for the uncontrolled web application, wherein the request is generated by code downloaded from the uncontrolled web application to the device associated with the user in the computing environment, the code acting as an agent for the uncontrolled web application;
at the service module, determining whether the request destined for the uncontrolled web application is to be intercepted;
if the request is not to be intercepted, the service module forwarding the request to a destination referenced in the request;
if the request is to be intercepted, the service module placing the request in a moderation flow, wherein the moderation flow comprises:
determining whether the request is to be blocked from or approved for reaching the uncontrolled web application; and
blocking or approving the request, wherein approving the request comprises:
reconstructing the request for resubmission to the uncontrolled web application, wherein the resubmission comprises:
detecting that the user logs in to the uncontrolled web application or automatically providing user log in information to the uncontrolled web application; and
submitting the reconstructed request.
3. The method according to
4. The method according to
6. The method according to
disabling at least one feature on a web page originating from the network site; and
forwarding the web page with the at least one feature disabled.
7. The method according to
submitting the reconstructed request via an application programming interface specific to the uncontrolled web application.
9. The computer program product of
determining whether the request is to be quarantined; and
preparing a simulated response to be sent back to the device if the request is to be quarantined.
10. The computer program product of
disabling at least one feature on a web page originating from the network site; and
forwarding the web page with the at least one feature disabled.
11. The computer program product of
submitting the reconstructed request via an application programming interface specific to the uncontrolled web application.
13. The system of
determining whether the request is to be quarantined; and
prepare a simulated response to be sent back to the device if the request is to be quarantined.
14. The system of
submitting the reconstructed request via an application programming interface specific to the uncontrolled web application.
15. The method according to
20. The system of
disabling at least one feature on a web page originating from the network site.
|
This disclosure relates generally to Web applications and more particularly to social networking applications. Even more particularly, this disclosure relates to a system, method, and computer program product comprising instructions translatable to intercept, quarantine, and moderate communications internal to systems that are beyond the control of computing environments where embodiments disclosed herein may reside.
Advances in communications technology often change how people communicate and share information. More recently, social networking sites are providing new ways for users to interact and keep others abreast of their personal and business dealings. The growth of social networking sites is staggering. New sites are emerging daily and new users are joining in droves. Today, social networking sites are being used regularly by millions of people around the globe, and it seems that social networking via websites will continue to be a part of everyday life at least in the United States.
The main types of social networking services provided by social networking sites are those which contain directories or categories, a means to connect with friends, and a means to recommend other individuals. For example, a social networking site may allow a user to identify an individual as a friend, a former classmate, or an uncle. The social networking site may recommend to the user another individual as a potential friend and also provide a personalized web page for the user to interact with those that the user has identified as “friends” via the social networking site.
Some social networking sites provide functions in the form of Web applications for members to create user profiles, send messages to other members who are their “friends,” and personalize Web pages available to friends and/or the general public. Through these Web applications, social networking sites can connect people at low cost and very high efficiency. Some entrepreneurs and businesses looking to expand their contact base have recognized these benefits and are utilizing some social networking sites as a customer relationship management tool for selling their products and services.
For businesses and entities alike looking to embrace social networking sites as an additional method to exchange information between employees, clients, vendors, etc., the integration of social networking sites into their internal computing environments necessarily raises several critical concerns. What activities will people be allowed to be engaged in? What information may be disclosed and to what extent? Who is the information being disclosed to? Is malicious or otherwise damaging material being accessed or allowed onto the business's computers? How can a business manage the activities of particular users or groups?
Currently, there are no viable solutions to these difficult questions as businesses do not have control over Web applications and associated data provided by independent entities, including social networking sites own and operated by such independent entities. Some businesses have the means to block traffic to and from social networking sites. Some businesses can only hope that their employees are only using these social networking sites in the best interest of the company. There is no guarantee that the employees may police their own access to and participation at social networking sites and there is always the concern of an employee knowingly or unknowingly posting confidential information on a social networking site. Because of these risks, many businesses simply choose to deny their employees access to uncontrolled Web applications and forgo the efficiencies and cooperative gains that may come from embracing social networking sites.
Traditionally, to the extent that a business or entity allows users within its computing environment access to the Internet, it has no ways of controlling, monitoring, and/or archiving communications between its users and Web applications that are not provided by the business or entity. This type of Web applications is referred to herein as uncontrolled Web applications as they are not controlled by the business or entity that operates the computing environment from where user requests for access are generated. Uncontrolled Web applications or software systems are collectively referred to herein as uncontrolled systems. Uncontrolled systems may come in various forms. One example of an uncontrolled system may be an application running on a social networking site such as Facebook.
While Web scanning systems may be able to monitor network traffic and detect certain words or patterns and block a request to a social networking site, they have no method to block the request elegantly, without breaking the user experience. Moreover, conventional Web scanning systems have no means of resubmitting the request if it is approved by a moderator.
Embodiments disclosed herein provide a system, method, and computer program programming comprising one or more non-transitory computer readable storage media storing computer instructions for intercepting, quarantine, and moderating internal communications of uncontrolled systems. In some embodiments, the functionality disclosed herein can be implemented as a middleware or proxy within or outside an enterprise computing environment, a private network, or the like.
In some embodiments, a method for intercepting, quarantine, and moderating internal communications of an uncontrolled system may comprise loading an instance of the uncontrolled system on a device associated with a user in a computing environment. The uncontrolled system may reside at a server computer external to and independent and separate from the computing environment. During the course of accessing the uncontrolled system, the user may type in a message as usual. An instance of the uncontrolled system running on the user's device may prepare a request containing the message. Some embodiments disclosed herein may determine that the message is subject to moderation, intercept the request, and place the message in a moderation queue. This determination may be based on the destination of the request as well the type of the message.
In some embodiments, a proxy server may perform the interception and put the original request in a moderation queue. In some embodiments, the moderation queue may reside within or outside of the computing environment. In some embodiments, a proxy server may perform all the functions disclosed herein, including interception, quarantine, moderation, resubmission, and so on.
In some embodiments, moderation may comprise automated moderation, manual moderation, or a combination thereof. Through moderation, intercepted requests may be blocked or allowed to be resubmitted. When an intercepted request is approved for resubmission, some embodiments may reconstruct the original request. If a session corresponding to the original request has since expired, some embodiments may log in for the user and resubmit the reconstructed request. Some embodiments may simply wait for the next time the user logs in to resubmit the reconstructed request. Some embodiments may comprise a plurality of application programming interfaces (APIs), each of which is specific to an uncontrolled system, and may communicate the reconstructed request with the uncontrolled system via a corresponding API.
Because embodiments disclosed herein have the ability to intercept, quarantine, and moderate communications internal to uncontrolled systems, it may not be necessary for an entity operating a private network to block its users from accessing such uncontrolled systems entirely. In this way, it is possible for entities and enterprises alike to gain benefits that may come from embracing social networking sites without risking the downsides of allowing their users access to uncontrolled Web applications.
These, and other, aspects of the disclosure will be better appreciated and understood when considered in conjunction with the following description and the accompanying drawings. It should be understood, however, that the following description, while indicating various embodiments of the disclosure and numerous specific details thereof, is given by way of illustration and not of limitation, Many substitutions, modifications, additions and/or rearrangements may be made within the scope of the disclosure without departing from the spirit thereof, and the disclosure includes all such substitutions, modifications, additions and/or rearrangements.
The drawings accompanying and forming part of this specification are included to depict certain aspects of the disclosure. It should be noted that the features illustrated in the drawings are not necessarily drawn to scale. A more complete understanding of the disclosure and the advantages thereof may be acquired by referring to the following description, taken in conjunction with the accompanying drawings in which like reference numbers indicate like features and wherein:
The disclosure and various features and advantageous details thereof are explained more fully with reference to the exemplary, and therefore non-limiting, embodiments illustrated in the accompanying drawings and detailed in the following description. Descriptions of known programming techniques, computer software, hardware, operating platforms and protocols may be omitted so as not to unnecessarily obscure the disclosure in detail. It should be understood, however, that the detailed description and the specific examples, while indicating the preferred embodiments, are given by way of illustration only and not by way of limitation. Various substitutions, modifications, additions and/or rearrangements within the spirit and/or scope of the underlying inventive concept will become apparent to those skilled in the art from this disclosure.
Software implementing embodiments disclosed herein may be implemented in suitable computer-executable instructions that may reside on one or more computer-readable storage media. Within this disclosure, the term “computer-readable storage media” encompasses all types of data storage media that can be read by a processor. Examples of computer-readable storage media can include random access memories, read-only memories, hard drives, data cartridges, magnetic tapes, floppy diskettes, flash memory drives, optical data storage devices, compact-disc read-only memories, and other appropriate computer memories and data storage devices.
As used herein, the terms “comprises,” “comprising,” “includes,” “including,” “has,” “having,” or any other variation thereof, are intended to cover a non-exclusive inclusion. For example, a process, product, article, or apparatus that comprises a list of elements is not necessarily limited only those elements but may include other elements not expressly listed or inherent to such process, process, article, or apparatus. Further, unless expressly stated to the contrary, “or” refers to an inclusive or and not to an exclusive or. For example, a condition A or B is satisfied by any one of the following: A is true (or present) and B is false (or not present), A is false (or not present) and B is true (or present), and both A and B are true (or present).
Additionally, any examples or illustrations given herein are not to be regarded in any way as restrictions on, limits to, or express definitions of, any term or terms with which they are utilized. Instead these examples or illustrations are to be regarded as being described with respect to one particular embodiment and as illustrative only. Those of ordinary skill in the art will appreciate that any term or terms with which these examples or illustrations are utilized encompass other embodiments as well as implementations and adaptations thereof which may or may not be given therewith or elsewhere in the specification and all such embodiments are intended to be included within the scope of that term or terms. Language designating such non-limiting examples and illustrations includes, but is not limited to: “for example,” “for instance,” “e.g.,” “in one embodiment,” and the like.
Those skilled in the arts will recognize that the disclosed embodiments have relevance to a wide variety of areas in addition to the specific examples described below. For example, although the examples below are described in the context of employers and employees, some embodiments disclosed herein can be adapted or otherwise implemented to work in other types of relationships, circumstances, and places such as public libraries, parent-child, school-student, or any other place or relationship where it is desirable to monitor and protect network traffic to and from social networking sites.
In some cases, proxy 150 of company network 140 may monitor and block all network traffic to and from one or more social networking sites 120 by way of a firewall implemented on proxy 150. As known to those skilled in the art, a firewall may be implemented as a part of a computer system or network that is designed to block unauthorized access while permitting authorized communications. A firewall may be implemented as a device or a set of devices configured to permit, deny, encrypt, decrypt, or proxy all incoming and outgoing network traffic between different domains based upon a set of rules and other criteria. Firewalls may be implemented in hardware, software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. Generally, all messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.
Proxy 150 represents a server computer that acts as an intermediary for requests from user 130 seeking resources from other servers, including those that reside outside of network 140. Those skilled in the art can appreciate that user 130 is a representation of a typical user in company network 149 and may include software and hardware utilized by the user to access company network 140 and Internet 110.
Computing system 200 may include a variety of computer readable storage media. Computer readable storage media can be any available storage media that can be accessed by computing system 200. By way of example, and not of limitation, computer readable storage media may comprise volatile and nonvolatile storage media and removable and non-removable storage media. Computer readable storage media storing computer instructions implementing embodiments disclosed herein may be manufactured by known methods and materials and may rely on known programming languages and techniques for storage of information thereon. Examples of computer readable storage media may include, but are not limited to, random access memory (RAM), read only memory (ROM), EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by computing system 200.
In the example shown in
Computing system 200 may also include other removable/non-removable, volatile/nonvolatile computer readable storage media that can be employed to store computer instructions implementing some embodiments disclosed herein. By way of example only, computing system 200 may include hard disk drive 224, a magnetic disk drive 226, and/or optical disk drive 230. Hard drive (HD) 224 may read from and write to non-removable, nonvolatile magnetic media. Disk drive 226 may read from and write to removable, nonvolatile magnetic disk 228. Optical disk drive 230 may read from and write to a removable, nonvolatile optical disk 232 such as a CD ROM or other optical medium. Other removable/non-removable, volatile/nonvolatile computer readable storage media are also possible. As illustrated in
The drives and their associated computer readable storage media, discussed above, may provide storage of computer readable instructions, data structures, program modules and other data for computing system 200. For example, hard disk drive 224 may store operating system 268, application programs 270, other program modules 272 and program data 274. Note that these components can either be the same as or different from operating system 216, application programs 218, other program modules 220, and program data 222.
A user may enter commands and information into computing system 200 via input devices such as tablet or electronic digitizer 240, microphone 242, keyboard 244, and pointing device 246. Pointing device 246 may comprise a mouse, a trackball, and/or a touch pad. These and other input devices may be connected to processing unit 204 via user input interface 248. User input interface 248 may be coupled to system bus 208 or via other interface and bus structures, such as a parallel port, a game port, or a universal serial bus (USB).
Monitor or other type of display device 250 may be connected to system bus 208 via an interface, such as a video interface 252. Monitor 250 may also be integrated with a touch-screen panel or the like. Note that the monitor and/or touch screen panel can be physically coupled to a housing in which computing system 200 is incorporated, such as in a tablet-type personal computer. Computing system 200 may comprise additional peripheral output devices such as speakers 256 and printer 254, which may be connected via an output peripheral interface 258 or the like.
Computing system 200 may operate in a networked environment and may have logical connections to one or more remote computers, such as remote computing system 260. Remote computing system 260 may be a personal computer, a server, a router, a network PC, a peer device or other common network node. Although only a memory storage device 262 is shown in
Logical connections between computing system 200 and remote computing system 260 may include local area network (LAN) 264, connecting through network interface 276, and wide area network (WAN) 266, connecting via modem 278. Additional networks may also be included.
Embodiments disclosed herein can be implemented to run on various platforms operating under system software such as IBM OS/2®, Linux®, UNIX®, Microsoft Windows®, Apple Mac OSX® and others in development or commercially available. The functionality disclosed herein may be embodied directly in hardware, in a software module executed by a processor or in any combination of the two. Furthermore, software operations may be executed, in part or wholly, by one or more servers or a client's system, via hardware, software module or any combination of the two. A software module (program or executable) may reside on one or more computer readable storage media described above. In
In an illustrative embodiment, computer instructions implementing some embodiments disclosed herein may comprise lines of compiled C++, Java, or other language code. Other architectures may be used. In the hardware configuration above, various software components may reside on any single computer or on any combination of separate computers. In some embodiments, some or all of the software components may reside on the same computer. In some embodiments, the functions of any of the systems and methods may be performed by a single computer. In some embodiments, different computers than are shown in
More specifically, as described below in more detail, code 330 of uncontrolled system 320 is responsible for communications 340. This is in contrast to the generic network traffic described above with reference to
Referring also to
Those skilled in the art will appreciate that it may not be necessary to perform all the steps of method 500 and that some steps may be skipped. Further, in some embodiments, additional steps may be included in method 500. Other modifications and variations may be possible without departing from the scopes and the spirits of this disclosure.
In some embodiments, method 500 may further comprise performing moderation on one or more jobs in the moderation queue (step 507). In some embodiments, Socialware 310 may comprise a plurality of software tools 620, including moderation 660. In some embodiments, moderation 660 may be automated or semi-automated. In some embodiments, method 500 may further comprise determining whether to block a request or allow it to be resubmitted to uncontrolled system 320 (step 514). In some embodiments, if the request is not approved via moderation 660, the request is blocked (step 523). In some embodiments, if the request is approved, method 500 may further comprise performing resubmission of the approved request (step 509). In some embodiments, this may involve reconstructing the original, intercepted request.
If a session corresponding to the original request has since expired, some embodiments may log in for the user and resubmit the reconstructed request. Some embodiments may simply wait for the next time the user logs in to resubmit the reconstructed request. Some embodiments may comprise a plurality of application programming interfaces (APIs), each of which is specific to an uncontrolled system, and may communicate the reconstructed request with the uncontrolled system via a corresponding API.
Company B may comprise hardware, software, infrastructure, and people necessary to operate and maintain social networking site 320. Social networking site 320 may be implemented in a manner known to those skilled in the art. As a specific example, a user may log in to social networking site 320 via a browser application or via a mobile application running on the user's wired or wireless computing device. Examples of a wireless computing device may include, but are not limited to, a laptop computer, a personal digital assistant (PDA), a mobile phone, an Internet enabled mobile device, and so on.
In the example of
As described above, in some embodiments, as users in network 140 post messages to social networking site 320 or any of the sites designated as subject to interception, Socialware 310 may operate to stop these messages and send them through a moderation process (step 507). If a message is to be blocked (step 523), Socialware 310 may simulate a response to the user device from where the message is originated. The simulated response may resemble a response from social networking site 320, with an indication that the user's message has been blocked. An example of such a response may be a Web page that is structured and assembled by Socialware 310 on-the-fly, with at least one feature-level modification to inform the user that the message has been blocked. In some embodiments, other than certain feature(s) being disabled or unavailable to user 130, the simulated response generated by Socialware 310 may be substantially similar to a corresponding response generated by social networking site 320. Readers are directed to co-pending U.S. patent application Ser. No. 12/785,294, filed May 21, 2010, entitled “METHOD, SYSTEM AND COMPUTER PROGRAM PRODUCT FOR STRUCTURING UNSTRUCTURED DATA ORIGINATING FROM UNCONTROLLED WEB APPLICATION,” for examples of structuring unstructured data originating from an uncontrolled Web application and co-pending U.S. patent application Ser. No. 12/785,278, filed May 21, 2010, entitled “METHOD, SYSTEM AND COMPUTER PROGRAM PRODUCT FOR ENFORCING ACCESS CONTROLS TO FEATURES AND SUBFEATURES ON UNCONTROLLED WEB APPLICATION,” for examples of feature-level modifications to data originating from an uncontrolled Web application. Within this disclosure, features/subfeatures of an uncontrolled application refer to software components/subcomponents of the uncontrolled application. In some embodiments, a feature or subfeature of an uncontrolled application may be a function that allows a user to take a certain action via the uncontrolled application. Non-limiting examples of features may include status update, wall post, messaging, chat, photo upload, commenting, and so on. Non-limiting examples of subfeatures may include functions involved when using a feature. For example, a “like” button associated with the status update feature may be considered as a subfeature. Moreover, certain features/subfeatures may be common to two or more social networking sites. Status update may be one example feature that is common to many social networking sites.
In the example of
Unlike conventional network traffic interception, the interception disclosed here is source/destination specific as well as content type specific. In some embodiments, Socialware 310 may have prior knowledge of what uncontrolled systems may be accessed by users in network 140. For example, Socialware 310 may have access to a list of universal resource locator (URL) addresses that are associated with uncontrolled systems and that are subject to interception, quarantine, and/or moderation. An example of such an URL may be: <http://www.twitter.com/status/update>. In some embodiments, Socialware 310 may have prior knowledge of what type of content in a user request referencing one of the designated URL would be subject to interception. For example, Socialware 310 may inspect or parse the request and determine that the request is of the status update type and, as such, is subject to interception.
In some embodiments, an automated moderation process may comprise determining a type of the request and processing a payload of the request accordingly. For example, if it is determined that the request is of the status update type, the automated moderation process may determine that the payload of the request should be blocked. An example of such a payload may be “status=‘hello world’”.
As another example, Socialware 310 may inspect or parse the request and determine that the request is subject to quarantine and operate to isolate the request without putting the request through any moderation process.
In some embodiments, Socialware 310 may inspect or parse the request and determine how the request should be automatically moderated based on a variety of factors, including, but are not limited to, company policies, business rules, feature types, keywords, patterns, user privilege, user role, etc.
An example of a pattern of interest may be a 16-digit number representing a credit card number that the user has provided in the request to the uncontrolled system. In one embodiment, Socialware 310 may operate to intercept such a request and block the user's submission of the credit card number. Another example of a pattern of interest may be a social security number.
In some embodiments, the feature types that would be useful in automated moderation may include, but are not limited to, the following:
Within each feature type, there may be subtypes (subfeatures). For example, the subtypes of broadcasts may include wall posts, tweets, status updates, etc. The subtypes of actions may include adding a friend, making a recommendation, searching a friend, a word, a page, an event, and so on. The subtypes of profile may include name, location, hobbies, links, etc. The subtypes of directed messages may include private messages, group mail, Web based mail, etc. Each source or social networking site would have a distinct set of features or application components (including subfeatures or subcomponents), one or more of which may be of interest to Company A for the purpose of controlling accesses thereto by users of network 140. In some embodiments, the definitions or specifications of source-specific features and subfeatures may be maintained in a centralized location such as a library or a database that is accessible by Socialware 310.
In some embodiments, a semi-automated moderation process may comprise conducting an automatic coarse analysis of an intercepted request and forwarding the request for a more detailed manual review or evaluation. In some embodiments, Socialware 310 may implement a completely automated process (i.e., intercept and moderate every request designating an uncontrolled system), a mostly manual moderation process, and something in between. For example, in some embodiments, Socialware 310 may randomly intercept 20% of the requests in network 140 designating uncontrolled systems 320.
In some embodiments, Socialware 310 may comprise filters. Within this disclosure, a filter comprises a piece of code that is designed to recognize a particular portion of an application-level dynamic protocol. Hypertext Transfer protocol (http) is an example of an application-level protocol. Unlike defined or otherwise standardized protocols such as those used in e-mail communications and instant messaging, dynamic protocols used by social networking sites may change over time, be undefined, and/or vary from site to site. Dynamic protocols are known to those skilled in the art and techniques for parsing network traffic in such protocols are also known to those skilled in the art.
In some embodiments, Socialware 310 may comprise various filters for parsing and access control. Below is an example of a filter for parsing an example HTML message from a social networking site known as Facebook.
Filter 1-Parse HTML Message
void parse(String payload) {
HTMLDoc doc=HTMLDoc.parse(payload);
HTMLElement element=doc.findByClass(“message”);
String message=element.text( );
return message;
}
Socialware 310 may further comprise various filters for content control and for understanding how, when, and what application external to network 140 is changing, and/or what type of change is involved. It could be a functional change, a layout change, a message format change, etc. For example, some embodiments may implement one or more of the following non-limiting types of filters:
Below are non-limiting examples of various types of Socialware filters written for the example social networking site Facebook.
1) Access control filter, to disable Facebook chat:
void process(String page, User user) {
HTMLDoc doc = HTMLDoc.parse( page );
if (user.canAccessFacebookChat( ) == false) {
doc.findById( “chat” ).delete( );
}
}
2) Data archiving filter, to record Facebook chat:
void process(String page, User user) {
HTTPPost post = HTTPPost.parse( page );
String fromUsername = post.getParam( “fromUser” );
String toUsername = post.getParam( “toUser” );
String message = post.getParam( “message” );
DataStore.record( fromUser, toUser, message );
}
3) Data security filter, to block credit card numbers from posting
to Facebook walls:
void process(String page, User user) {
HTTPPost post = HTTPPost.parse( page );
String wallPost = post.getParam( “wall_post” );
if ( ContainsCreditCardNumber( wallPost ) == true ) {
ReturnErrorToUser( );
} else {
AllowMessageToPost( );
}
}
4) Secure messaging filter, to replace Facebook wall post messages
with a placeholder:
// When posting a facebook wall post
void process( String page, User user ) {
HTTPPost post = HTTPPost.parse( page );
String message = post.getParam( “wall_post” );
String placeholder = GetPlaceholder( message );
post.setParam( “wall_post” );
// update the page with the new placeholder instead of message
page = post.toString( );
}
// When viewing a wall message
void process( String page, User user ) {
String placeholder = GetPlaceholder( page );
String message = GetMessage( placeholder );
// replace the placeholder with the original message
page.replace( placeholder, message);
}
5) Notification Filters, add a watermark to Facebook
void process( String page, User user ) {
HTMLDoc doc = HTMLDoc.parse( page );
// Insert new HTML code for the watermark
doc.addElement ( GenerateFacebookWatermark( ) );
page = doc.toString( );
}
One skilled in the art will appreciate that other types of filters are also possible and that these filters would be source-specific and may vary from implementation to implementation.
Note that Socialware filters are distinct from filters used by conventional Web scanning systems. While Web scanning systems may be able to monitor network traffic and detect certain words or patterns and block a request to a social networking site, they have no method to block the request elegantly, without breaking the user experience. One reason is that when a Web filter blocks an http request, it generally does not send a response back to the application that made the request. Consequently, the application either continues to run indefinitely or simply times out, thereby breaking the user experience. This kind of Web filters is generally applied to all the network traffic under monitoring, without regard to the destination. Moreover, conventional Web scanning systems have no means of resubmitting the request if it is approved by a moderator.
On the other hand, some network sites may utilize internal filters to monitor incoming traffic and perform some kind of moderation before forwarding an incoming request to its internal destination.
Although shown and described throughout this disclosure with specific reference to an enterprise, this disclosure is intended to encompass other networking and business environments including, but not limited to: small businesses, individual users, homes, public networks, etc. It should be understood that the description is by way of example only and is not to be construed in a limiting sense. It is to be further understood, therefore, that numerous changes in the details of the embodiments disclosed herein and additional embodiments will be apparent to, and may be made by, persons of ordinary skill in the art having reference to this description. For example, in addition to the above described embodiments, those skilled in the art will appreciate that this disclosure has application in a wide array of arts in addition to social networking and this disclosure is intended to include the same. Accordingly, the scope of the present disclosure should be determined by the following claims and their legal equivalents.
Patent | Priority | Assignee | Title |
10057271, | Jul 31 2015 | SONICWALL US HOLDINGS INC | Social media login and interaction management |
10110571, | May 26 2015 | SONICWALL US HOLDINGS INC | Securing internet of things communications across multiple vendors |
10129260, | Jun 25 2013 | Amazon Technologies, Inc | Mutual privacy management |
10187446, | Mar 23 2015 | SONICWALL US HOLDINGS INC | Firewall multi-level security dynamic host-based sandbox generation for embedded URL links |
10225235, | Mar 23 2015 | SONICWALL US HOLDINGS INC | Non RFC-compliant protocol classification based on real use |
10230593, | May 21 2010 | Proofpoint, Inc | Method, system and computer program product for interception, quarantine and moderation of internal communications of uncontrolled systems |
10291607, | Feb 02 2016 | Amazon Technologies, Inc | Providing real-time events to applications |
10382197, | Feb 24 2014 | Amazon Technologies, Inc | Key management and dynamic perfect forward secrecy |
10396982, | Feb 24 2014 | Amazon Technologies, Inc | Key management and dynamic perfect forward secrecy |
10404553, | May 21 2010 | PROOFPOINT, INC. | Method, system and computer program product for interception, quarantine and moderation of internal communications of uncontrolled systems |
10511496, | May 21 2010 | PROOFPOINT, INC. | Method, system and computer program product for interception, quarantine and moderation of internal communications of uncontrolled systems |
10523793, | Jul 11 2016 | Meta Platforms, Inc | Kernel multiplexing system of communications |
10567349, | Jun 25 2013 | Amazon Technologies, Inc | Secure time-to-live |
11032398, | Jul 11 2016 | Meta Platforms, Inc | Kernel multiplexing system of communications |
11303693, | Mar 23 2015 | SONICWALL US HOLDINGS INC | Firewall multi-level security dynamic host-based sandbox generation for embedded URL links |
11330003, | Nov 14 2017 | Amazon Technologies, Inc | Enterprise messaging platform |
11362811, | Apr 14 2016 | Amazon Technologies, Inc | Secure telecommunications |
11405370, | Apr 14 2016 | Amazon Technologies, Inc | Secure file transfer |
11671477, | Mar 23 2015 | SonicWALL Inc. | Firewall multi-level security dynamic host-based sandbox generation for embedded URL links |
9130822, | May 21 2010 | Proofpoint, Inc | Method, system and computer program product for interception, quarantine and moderation of internal communications of uncontrolled systems |
9584316, | Jul 16 2012 | Amazon Technologies, Inc | Digital security bubble |
9584493, | Dec 18 2015 | Amazon Technologies, Inc | Decentralized authoritative messaging |
9584530, | Jun 27 2014 | Amazon Technologies, Inc | In-band identity verification and man-in-the-middle defense |
9590956, | Dec 18 2015 | Amazon Technologies, Inc | Decentralized authoritative messaging |
9590958, | Apr 14 2016 | Amazon Technologies, Inc | Secure file transfer |
9591479, | Apr 14 2016 | Amazon Technologies, Inc | Secure telecommunications |
9596079, | Apr 14 2016 | Amazon Technologies, Inc | Secure telecommunications |
9602477, | Apr 14 2016 | Amazon Technologies, Inc | Secure file transfer |
9608959, | Mar 23 2015 | SONICWALL US HOLDINGS INC | Non RFC-compliant protocol classification based on real use |
9628449, | Jul 16 2012 | Amazon Technologies, Inc | Multi party messaging |
9654288, | Dec 11 2014 | Amazon Technologies, Inc | Securing group communications |
9667417, | Jul 16 2012 | Amazon Technologies, Inc | Digital security bubble |
9673973, | Dec 18 2015 | Amazon Technologies, Inc | Decentralized authoritative messaging |
9698976, | Feb 24 2014 | Amazon Technologies, Inc | Key management and dynamic perfect forward secrecy |
9729315, | Jul 16 2012 | Amazon Technologies, Inc | Initialization and registration of an application |
9825921, | May 26 2015 | SonicWALL Inc.; QUEST SOFTWARE INC | Securing internet of things communications across multiple vendors |
9830089, | Jun 25 2013 | Amazon Technologies, Inc | Digital data sanitization |
9838357, | Mar 23 2015 | SONICWALL US HOLDINGS INC | Non RFC-compliant protocol classification based on real use |
9866591, | Jun 25 2013 | Amazon Technologies, Inc | Enterprise messaging platform |
9876772, | Jul 16 2012 | Amazon Technologies, Inc | Encrypting and transmitting data |
9888011, | Jul 31 2015 | SONICWALL US HOLDINGS INC | Social media login and interaction management |
Patent | Priority | Assignee | Title |
7586871, | May 22 2001 | OPTIMORPHIX, INC | Platform and method for providing data services in a communication network |
20080178298, | |||
20090313318, | |||
20100106777, | |||
20110125697, | |||
20120023090, |
Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
May 21 2010 | Socialware, Inc. | (assignment on the face of the patent) | / | |||
Jul 02 2010 | COOPER, CAMERON BLAIR | SOCIALWARE, INC | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 024687 | /0987 | |
Jan 28 2016 | SOCIALWARE, INC | Proofpoint, Inc | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 037615 | /0370 | |
Aug 31 2021 | Proofpoint, Inc | GOLDMAN SACHS BANK USA, AS COLLATERAL AGENT | FIRST LIEN INTELLECTUAL PROPERTY SECURITY AGREEMENT | 057389 | /0615 | |
Aug 31 2021 | Proofpoint, Inc | GOLDMAN SACHS BANK USA, AS COLLATERAL AGENT | SECOND LIEN INTELLECTUAL PROPERTY SECURITY AGREEMENT | 057389 | /0642 | |
Mar 21 2024 | GOLDMAN SACHS BANK USA, AS AGENT | Proofpoint, Inc | RELEASE OF SECOND LIEN SECURITY INTEREST IN INTELLECTUAL PROPERTY | 066865 | /0648 |
Date | Maintenance Fee Events |
Apr 25 2016 | ASPN: Payor Number Assigned. |
May 12 2016 | STOL: Pat Hldr no Longer Claims Small Ent Stat |
May 18 2017 | M1551: Payment of Maintenance Fee, 4th Year, Large Entity. |
May 28 2021 | M1552: Payment of Maintenance Fee, 8th Year, Large Entity. |
Date | Maintenance Schedule |
Dec 03 2016 | 4 years fee payment window open |
Jun 03 2017 | 6 months grace period start (w surcharge) |
Dec 03 2017 | patent expiry (for year 4) |
Dec 03 2019 | 2 years to revive unintentionally abandoned end. (for year 4) |
Dec 03 2020 | 8 years fee payment window open |
Jun 03 2021 | 6 months grace period start (w surcharge) |
Dec 03 2021 | patent expiry (for year 8) |
Dec 03 2023 | 2 years to revive unintentionally abandoned end. (for year 8) |
Dec 03 2024 | 12 years fee payment window open |
Jun 03 2025 | 6 months grace period start (w surcharge) |
Dec 03 2025 | patent expiry (for year 12) |
Dec 03 2027 | 2 years to revive unintentionally abandoned end. (for year 12) |